0

In Wireshark, when I follow a TCP or UDP stream using right click -> Follow -> UDP Stream, if there are some ICMP packets from same endpoints, wireshark will keep them in the stream. Why? Since ICMP is a different protocol from UDP/TCP, shouldn't it be filtered out? Is this a bug? If not, what is the reason to include non UDP packet in a UDP stream?

4
  • Please add more details to your question for anyone to answer it. Are you using the Analyze → Follow →TCP/UDP Stream option? Or trying to set up a capture or display filter?
    – Zac67
    Feb 3 at 17:07
  • @Zac67 I updated the question. Feb 3 at 17:43
  • It's best to ask on the Wireshark Wiki. We can't speculate.
    – Ron Trunk
    Feb 3 at 18:09
  • Has any answer solved your question? Then please accept it or your question will keep popping up here forever. Please also consider voting for useful answers.
    – Zac67
    Mar 5 at 9:52

1 Answer 1

0

ICMP is IP's messaging system.

In addition to the well-known echo request/reply functions used with ping, it transmits various errors codes for occuring problems. The first 64 bits (8 octets) of the original payload (L3 SDU) are returned with the ICMP error message to enable the sending stack to identify the calling process and to generate a meaningful error message.

Wireshark's flow analysis includes ICMP messages between the relevant hosts to allow you access to those errors.

For details, see RFC 792.

3
  • I understand ICMP protocol. But it is a transport layer protocol same like UDP. So if I follow an UDP protocol, shouldn't it only display UDP and not ICMP? Feb 4 at 7:04
  • 2
    That's up to the developers to decide. You could argue your case to them but I think they made it that way because they thought it would be useful or because they had requests to make it that way. I would assume that their philosophy is that it is relevant to the stream even if it is not the same protocol so they keep it in. Mar 5 at 0:39
  • 1
    @SouravKannanthaB ICMP doesn't belong to the transport layer. It's an integral part of the network layer, even though it is carried and encapsulated like L4.
    – Zac67
    Mar 5 at 6:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.